c2fee09fc1
Move the conditional loading of hardware DR6 with the guest's DR6 value
out of the core .vcpu_run() loop to fix a bug where KVM can load hardware
with a stale vcpu->arch.dr6.
When the guest accesses a DR and host userspace isn't debugging the guest,
KVM disables DR interception and loads the guest's values into hardware on
VM-Enter and saves them on VM-Exit. This allows the guest to access DRs
at will, e.g. so that a sequence of DR accesses to configure a breakpoint
only generates one VM-Exit.
For DR0-DR3, the logic/behavior is identical between VMX and SVM, and also
identical between KVM_DEBUGREG_BP_ENABLED (userspace debugging the guest)
and KVM_DEBUGREG_WONT_EXIT (guest using DRs), and so KVM handles loading
DR0-DR3 in common code, _outside_ of the core kvm_x86_ops.vcpu_run() loop.
But for DR6, the guest's value doesn't need to be loaded into hardware for
KVM_DEBUGREG_BP_ENABLED, and SVM provides a dedicated VMCB field whereas
VMX requires software to manually load the guest value, and so loading the
guest's value into DR6 is handled by {svm,vmx}_vcpu_run(), i.e. is done
_inside_ the core run loop.
Unfortunately, saving the guest values on VM-Exit is initiated by common
x86, again outside of the core run loop. If the guest modifies DR6 (in
hardware, when DR interception is disabled), and then the next VM-Exit is
a fastpath VM-Exit, KVM will reload hardware DR6 with vcpu->arch.dr6 and
clobber the guest's actual value.
The bug shows up primarily with nested VMX because KVM handles the VMX
preemption timer in the fastpath, and the window between hardware DR6
being modified (in guest context) and DR6 being read by guest software is
orders of magnitude larger in a nested setup. E.g. in non-nested, the
VMX preemption timer would need to fire precisely between #DB injection
and the #DB handler's read of DR6, whereas with a KVM-on-KVM setup, the
window where hardware DR6 is "dirty" extends all the way from L1 writing
DR6 to VMRESUME (in L1).
L1's view:
==========
<L1 disables DR interception>
CPU 0/KVM-7289 [023] d.... 2925.640961: kvm_entry: vcpu 0
A: L1 Writes DR6
CPU 0/KVM-7289 [023] d.... 2925.640963: <hack>: Set DRs, DR6 = 0xffff0ff1
B: CPU 0/KVM-7289 [023] d.... 2925.640967: kvm_exit: vcpu 0 reason EXTERNAL_INTERRUPT intr_info 0x800000ec
D: L1 reads DR6, arch.dr6 = 0
CPU 0/KVM-7289 [023] d.... 2925.640969: <hack>: Sync DRs, DR6 = 0xffff0ff0
CPU 0/KVM-7289 [023] d.... 2925.640976: kvm_entry: vcpu 0
L2 reads DR6, L1 disables DR interception
CPU 0/KVM-7289 [023] d.... 2925.640980: kvm_exit: vcpu 0 reason DR_ACCESS info1 0x0000000000000216
CPU 0/KVM-7289 [023] d.... 2925.640983: kvm_entry: vcpu 0
CPU 0/KVM-7289 [023] d.... 2925.640983: <hack>: Set DRs, DR6 = 0xffff0ff0
L2 detects failure
CPU 0/KVM-7289 [023] d.... 2925.640987: kvm_exit: vcpu 0 reason HLT
L1 reads DR6 (confirms failure)
CPU 0/KVM-7289 [023] d.... 2925.640990: <hack>: Sync DRs, DR6 = 0xffff0ff0
L0's view:
==========
L2 reads DR6, arch.dr6 = 0
CPU 23/KVM-5046 [001] d.... 3410.005610: kvm_exit: vcpu 23 reason DR_ACCESS info1 0x0000000000000216
CPU 23/KVM-5046 [001] ..... 3410.005610: kvm_nested_vmexit: vcpu 23 reason DR_ACCESS info1 0x0000000000000216
L2 => L1 nested VM-Exit
CPU 23/KVM-5046 [001] ..... 3410.005610: kvm_nested_vmexit_inject: reason: DR_ACCESS ext_inf1: 0x0000000000000216
CPU 23/KVM-5046 [001] d.... 3410.005610: kvm_entry: vcpu 23
CPU 23/KVM-5046 [001] d.... 3410.005611: kvm_exit: vcpu 23 reason VMREAD
CPU 23/KVM-5046 [001] d.... 3410.005611: kvm_entry: vcpu 23
CPU 23/KVM-5046 [001] d.... 3410.005612: kvm_exit: vcpu 23 reason VMREAD
CPU 23/KVM-5046 [001] d.... 3410.005612: kvm_entry: vcpu 23
L1 writes DR7, L0 disables DR interception
CPU 23/KVM-5046 [001] d.... 3410.005612: kvm_exit: vcpu 23 reason DR_ACCESS info1 0x0000000000000007
CPU 23/KVM-5046 [001] d.... 3410.005613: kvm_entry: vcpu 23
L0 writes DR6 = 0 (arch.dr6)
CPU 23/KVM-5046 [001] d.... 3410.005613: <hack>: Set DRs, DR6 = 0xffff0ff0
A: <L1 writes DR6 = 1, no interception, arch.dr6 is still '0'>
B: CPU 23/KVM-5046 [001] d.... 3410.005614: kvm_exit: vcpu 23 reason PREEMPTION_TIMER
CPU 23/KVM-5046 [001] d.... 3410.005614: kvm_entry: vcpu 23
C: L0 writes DR6 = 0 (arch.dr6)
CPU 23/KVM-5046 [001] d.... 3410.005614: <hack>: Set DRs, DR6 = 0xffff0ff0
L1 => L2 nested VM-Enter
CPU 23/KVM-5046 [001] d.... 3410.005616: kvm_exit: vcpu 23 reason VMRESUME
L0 reads DR6, arch.dr6 = 0
Reported-by: John Stultz <jstultz@google.com>
Closes: https://lkml.kernel.org/r/CANDhNCq5_F3HfFYABqFGCA1bPd_%2BxgNj-iDQhH4tDk%2Bwi8iZZg%40mail.gmail.com
Fixes: 375e28ffc0 ("KVM: X86: Set host DR6 only on VMX and for KVM_DEBUGREG_WONT_EXIT")
Fixes: d67668e9dd ("KVM: x86, SVM: isolate vcpu->arch.dr6 from vmcb->save.dr6")
Cc: stable@vger.kernel.org
Cc: Jim Mattson <jmattson@google.com>
Tested-by: John Stultz <jstultz@google.com>
Link: https://lore.kernel.org/r/20250125011833.3644371-1-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
124 lines
6 KiB
C
124 lines
6 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef __KVM_X86_VMX_X86_OPS_H
|
|
#define __KVM_X86_VMX_X86_OPS_H
|
|
|
|
#include <linux/kvm_host.h>
|
|
|
|
#include "x86.h"
|
|
|
|
__init int vmx_hardware_setup(void);
|
|
|
|
extern struct kvm_x86_ops vt_x86_ops __initdata;
|
|
extern struct kvm_x86_init_ops vt_init_ops __initdata;
|
|
|
|
void vmx_hardware_unsetup(void);
|
|
int vmx_check_processor_compat(void);
|
|
int vmx_enable_virtualization_cpu(void);
|
|
void vmx_disable_virtualization_cpu(void);
|
|
void vmx_emergency_disable_virtualization_cpu(void);
|
|
int vmx_vm_init(struct kvm *kvm);
|
|
void vmx_vm_destroy(struct kvm *kvm);
|
|
int vmx_vcpu_precreate(struct kvm *kvm);
|
|
int vmx_vcpu_create(struct kvm_vcpu *vcpu);
|
|
int vmx_vcpu_pre_run(struct kvm_vcpu *vcpu);
|
|
fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu, bool force_immediate_exit);
|
|
void vmx_vcpu_free(struct kvm_vcpu *vcpu);
|
|
void vmx_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event);
|
|
void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu);
|
|
void vmx_vcpu_put(struct kvm_vcpu *vcpu);
|
|
int vmx_handle_exit(struct kvm_vcpu *vcpu, fastpath_t exit_fastpath);
|
|
void vmx_handle_exit_irqoff(struct kvm_vcpu *vcpu);
|
|
int vmx_skip_emulated_instruction(struct kvm_vcpu *vcpu);
|
|
void vmx_update_emulated_instruction(struct kvm_vcpu *vcpu);
|
|
int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info);
|
|
#ifdef CONFIG_KVM_SMM
|
|
int vmx_smi_allowed(struct kvm_vcpu *vcpu, bool for_injection);
|
|
int vmx_enter_smm(struct kvm_vcpu *vcpu, union kvm_smram *smram);
|
|
int vmx_leave_smm(struct kvm_vcpu *vcpu, const union kvm_smram *smram);
|
|
void vmx_enable_smi_window(struct kvm_vcpu *vcpu);
|
|
#endif
|
|
int vmx_check_emulate_instruction(struct kvm_vcpu *vcpu, int emul_type,
|
|
void *insn, int insn_len);
|
|
int vmx_check_intercept(struct kvm_vcpu *vcpu,
|
|
struct x86_instruction_info *info,
|
|
enum x86_intercept_stage stage,
|
|
struct x86_exception *exception);
|
|
bool vmx_apic_init_signal_blocked(struct kvm_vcpu *vcpu);
|
|
void vmx_migrate_timers(struct kvm_vcpu *vcpu);
|
|
void vmx_set_virtual_apic_mode(struct kvm_vcpu *vcpu);
|
|
void vmx_apicv_pre_state_restore(struct kvm_vcpu *vcpu);
|
|
void vmx_hwapic_isr_update(struct kvm_vcpu *vcpu, int max_isr);
|
|
int vmx_sync_pir_to_irr(struct kvm_vcpu *vcpu);
|
|
void vmx_deliver_interrupt(struct kvm_lapic *apic, int delivery_mode,
|
|
int trig_mode, int vector);
|
|
void vmx_vcpu_after_set_cpuid(struct kvm_vcpu *vcpu);
|
|
bool vmx_has_emulated_msr(struct kvm *kvm, u32 index);
|
|
void vmx_msr_filter_changed(struct kvm_vcpu *vcpu);
|
|
void vmx_prepare_switch_to_guest(struct kvm_vcpu *vcpu);
|
|
void vmx_update_exception_bitmap(struct kvm_vcpu *vcpu);
|
|
int vmx_get_feature_msr(u32 msr, u64 *data);
|
|
int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info);
|
|
u64 vmx_get_segment_base(struct kvm_vcpu *vcpu, int seg);
|
|
void vmx_get_segment(struct kvm_vcpu *vcpu, struct kvm_segment *var, int seg);
|
|
void vmx_set_segment(struct kvm_vcpu *vcpu, struct kvm_segment *var, int seg);
|
|
int vmx_get_cpl(struct kvm_vcpu *vcpu);
|
|
void vmx_get_cs_db_l_bits(struct kvm_vcpu *vcpu, int *db, int *l);
|
|
bool vmx_is_valid_cr0(struct kvm_vcpu *vcpu, unsigned long cr0);
|
|
void vmx_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0);
|
|
void vmx_load_mmu_pgd(struct kvm_vcpu *vcpu, hpa_t root_hpa, int root_level);
|
|
void vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4);
|
|
bool vmx_is_valid_cr4(struct kvm_vcpu *vcpu, unsigned long cr4);
|
|
int vmx_set_efer(struct kvm_vcpu *vcpu, u64 efer);
|
|
void vmx_get_idt(struct kvm_vcpu *vcpu, struct desc_ptr *dt);
|
|
void vmx_set_idt(struct kvm_vcpu *vcpu, struct desc_ptr *dt);
|
|
void vmx_get_gdt(struct kvm_vcpu *vcpu, struct desc_ptr *dt);
|
|
void vmx_set_gdt(struct kvm_vcpu *vcpu, struct desc_ptr *dt);
|
|
void vmx_set_dr6(struct kvm_vcpu *vcpu, unsigned long val);
|
|
void vmx_set_dr7(struct kvm_vcpu *vcpu, unsigned long val);
|
|
void vmx_sync_dirty_debug_regs(struct kvm_vcpu *vcpu);
|
|
void vmx_cache_reg(struct kvm_vcpu *vcpu, enum kvm_reg reg);
|
|
unsigned long vmx_get_rflags(struct kvm_vcpu *vcpu);
|
|
void vmx_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags);
|
|
bool vmx_get_if_flag(struct kvm_vcpu *vcpu);
|
|
void vmx_flush_tlb_all(struct kvm_vcpu *vcpu);
|
|
void vmx_flush_tlb_current(struct kvm_vcpu *vcpu);
|
|
void vmx_flush_tlb_gva(struct kvm_vcpu *vcpu, gva_t addr);
|
|
void vmx_flush_tlb_guest(struct kvm_vcpu *vcpu);
|
|
void vmx_set_interrupt_shadow(struct kvm_vcpu *vcpu, int mask);
|
|
u32 vmx_get_interrupt_shadow(struct kvm_vcpu *vcpu);
|
|
void vmx_patch_hypercall(struct kvm_vcpu *vcpu, unsigned char *hypercall);
|
|
void vmx_inject_irq(struct kvm_vcpu *vcpu, bool reinjected);
|
|
void vmx_inject_nmi(struct kvm_vcpu *vcpu);
|
|
void vmx_inject_exception(struct kvm_vcpu *vcpu);
|
|
void vmx_cancel_injection(struct kvm_vcpu *vcpu);
|
|
int vmx_interrupt_allowed(struct kvm_vcpu *vcpu, bool for_injection);
|
|
int vmx_nmi_allowed(struct kvm_vcpu *vcpu, bool for_injection);
|
|
bool vmx_get_nmi_mask(struct kvm_vcpu *vcpu);
|
|
void vmx_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked);
|
|
void vmx_enable_nmi_window(struct kvm_vcpu *vcpu);
|
|
void vmx_enable_irq_window(struct kvm_vcpu *vcpu);
|
|
void vmx_update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr);
|
|
void vmx_set_apic_access_page_addr(struct kvm_vcpu *vcpu);
|
|
void vmx_refresh_apicv_exec_ctrl(struct kvm_vcpu *vcpu);
|
|
void vmx_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap);
|
|
int vmx_set_tss_addr(struct kvm *kvm, unsigned int addr);
|
|
int vmx_set_identity_map_addr(struct kvm *kvm, u64 ident_addr);
|
|
u8 vmx_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio);
|
|
|
|
void vmx_get_exit_info(struct kvm_vcpu *vcpu, u32 *reason,
|
|
u64 *info1, u64 *info2, u32 *intr_info, u32 *error_code);
|
|
void vmx_get_entry_info(struct kvm_vcpu *vcpu, u32 *intr_info, u32 *error_code);
|
|
|
|
u64 vmx_get_l2_tsc_offset(struct kvm_vcpu *vcpu);
|
|
u64 vmx_get_l2_tsc_multiplier(struct kvm_vcpu *vcpu);
|
|
void vmx_write_tsc_offset(struct kvm_vcpu *vcpu);
|
|
void vmx_write_tsc_multiplier(struct kvm_vcpu *vcpu);
|
|
void vmx_update_cpu_dirty_logging(struct kvm_vcpu *vcpu);
|
|
#ifdef CONFIG_X86_64
|
|
int vmx_set_hv_timer(struct kvm_vcpu *vcpu, u64 guest_deadline_tsc,
|
|
bool *expired);
|
|
void vmx_cancel_hv_timer(struct kvm_vcpu *vcpu);
|
|
#endif
|
|
void vmx_setup_mce(struct kvm_vcpu *vcpu);
|
|
|
|
#endif /* __KVM_X86_VMX_X86_OPS_H */
|